This document provides an overview of incident response procedures, including the incident response life cycle of detection, categorization, containment, investigation, remediation, reporting, and learnings. It outlines roles and responsibilities, communication processes, and generic response playbooks. Resources for incident response frameworks and standards are also referenced.

1. INCIDENT RESPONSE
OVERVIEW
VERSION: 1.3a
DATE: 27/03/2019
AUTHOR: SYLVAIN MARTINEZ
REFERENCE: ESC15-MUSCL
CLASSIFICATION: PUBLIC
{elysiumsecurity}
cyber protection & response

2. 2
• Incident Response
Overview;
• Incident Response
Life Cycle;
• Rules of Engagement;
• 1. Detection;
• 2. Categorisation;
• 3. Containment;
• 4. Investigation;
• 5. Remediation;
• 6. Reporting;
• 7. Learnings.
• Generic Response
Playbook;
• Resources.
CONTENTS
PUBLIC
GOING FURTHERRESPONSECONTEXT
{elysiumsecurity}
cyber protection & response

3. 3
THE GOAL OF INCIDENT RESPONSE IS TO FIRST CONTAIN THE THREAT, THEN REMEDIATE
IT AND RECOVER FROM IT.
EFFICIENT INCIDENT RESPONSE RELIES ON ITS INCIDENT MANAGEMENT FRAMEWORK:
• CATEGORIES;
• ROLES;
• RESPONSABILITIES;
• COMMUNICATION;
• COORDINATION;
• PLAYBOOKS;
• SIMULATIONS;
• ETC.
PUBLIC
{elysiumsecurity}
cyber protection & response INCIDENT RESPONSE OVERVIEW
GOING FURTHERRESPONSECONTEXT

4. 4
1. DETECTION
2.
CATEGORISATION
3. CONTAINMENT
4. INVESTIGATION5. REMEDIATION
6. REPORTING
7. LEARNINGS
PUBLIC
{elysiumsecurity}
cyber protection & response INCIDENT RESPONSE LIFE CYCLE
GOING FURTHERRESPONSECONTEXT

5. 5
DO NOT ENGAGE OR INTERACT WITH THE
HACKER/THREAT GROUP
DO NOT CONNECT TO THE THREAT’S RELATED
NETWORK(S) FROM YOUR ORGANISATION
PRESERVE EVIDENCE
COORDINATE INTERNAL AND EXTERNAL
COMMUNICATION WITH MANAGEMENT
ALL INCIDENT DETAILS MUST BE TREATED AS
CONFIDENTIAL
DO NOT
MAKE
THINGS
WORSE!
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 0. RULES OF ENGAGEMENT
GOING FURTHERRESPONSECONTEXT

6. 6
WHO/WHAT DETECTED/REPORTED THE
THREAT?
WHAT IS THE DATE AND TIME OF THE THREAT
DETECTION/REPORT?
HOW WAS THE THREAT DETECTED/REPORTED?
HAS A SIMILAR THREAT ALREADY BEEN
REPORTED?
IS THE THREAT VALID?
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 1. DETECTION
GOING FURTHERRESPONSECONTEXT

7. 7
WHO/WHAT IS THE TARGET OF THE THREAT?
IS THIS AN ON GOING/LIVE THREAT?
WHAT IS THE IMPACT OF THE THREAT?
CATEGORISE THE PRIORITY OF THE INCIDENT
(P1, P2, P3)
CLASSIFY THE INCIDENT COMMUNICATION
(RESTRICTED/UNRESTRICTED)
PUBLIC
1
2
3
4
5
DECLARE AN
INCIDENT…
OR NOT!
{elysiumsecurity}
cyber protection & response 2. CATEGORISATION
GOING FURTHERRESPONSECONTEXT

8. 8
COORDINATE INCIDENT MANAGEMENT
(TEAM, COMMS, ACTIVITIES, DOCUMENTATION)
LIGHT AND QUICK THREAT ANALYSIS
(NETWORK, HOST, USER)
IDENTIFY MAIN ATTACK AND COMPROMISE
VECTORS
(IP, PORTS, SIGNATURES, EMAIL, ETC)
ISOLATE THE TARGETED ASSET
(REMOVE FROM NETWORK, DISABLE ACCOUNT, ETC)
IMPLEMENT EMERGENCY CHANGES AS
REQUIRED
(NETWORK, HOST, USER)
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 3. CONTAINMENT
GOING FURTHERRESPONSECONTEXT

9. 9
THREAT NETWORK ANALYSIS
(F/W, CLOUD APP LOGS, ASSET LOGS, INTERCEPTED TRAFFIC,
TRAFFIC AND DATA FLOWS, SIEM)
THREAT MALWARE ANALYSIS
(A/V VENDORS, FOOTPRINT, BEHAVIOR, REVERSE
ENGINEERING)
THREAT HOST ANALYSIS
(EVENT LOGS, APP/PLUGINS INSTALLED, AD/EMAIL ACTIVITIES,
AUTHENTICATED VA TO BE DONE, SIEM)
THREAT USER ANALYSIS
(INTERVIEW TARGETED USER, CONTEXT, TRIGGERS, RECENT
UNUSUAL ACTIVITIES/ALERTS)
THREAT RESEARCH ANALYSIS
(ONLINE SEARCH FOR SIMILAR THREATS, PROFESSIONAL
FORUMS, VENDOR ENGAGEMENT)
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 4. INVESTIGATION
GOING FURTHERRESPONSECONTEXT

10. 10
THREAT NETWORK REMEDIATION
(BLOCK IP, PORTS, DOMAINS, EMAILS.
UPDATE F/W, IDS, APT AND SIEM RULES)
THREAT MALWARE REMEDIATION
(UPDATE HOST AND NETWORK A/V SIGNATURES.
ENGAGE WITH VENDORS THAT DID NOT DETECT THE THREAT)
THREAT HOST REMEDIATION
(REMOVE/BAN INFECTED APPS/PLUGINS, CLEAR INBOX RULES,
REMEDIATE ISSUES FOUND DURING THE VA)
THREAT USER REMEDIATION
(INDIVIDUAL AND GROUP USER AWARENESS SESSION
RELEVANT TO THE THREAT)
DECLARE THE INCIDENT REMEDIATED
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 5. REMEDIATION
GOING FURTHERRESPONSECONTEXT

11. 11
ON GOING REPORTING
(DOCUMENTATION AND EVIDENCE SHOULD BE GENERATED AS
MUCH AS POSSIBLE DURING THE PREVIOUS PHASES)
EVIDENCE GATHERING
(THREAT ACTORS, ATTACK VECTORS, ATTACK SURFACE)
INCIDENT DOCUMENTATION
(THREAT AND INCIDENT DETAILS, TRIGGERS, OWNER,
FINDINGS, TIMELINE)
INCIDENT REGISTER
(CREATE/UPDATE AN OVERALL INCIDENT REGISTER TO TRACK
PROGRESS AND GENERATES STATISTICS. CAN BE LINKED TO
OTHER REGISTERS: RISKs/ISSUES)
INCIDENT REPORT COMMUNICATION
(AS REQUIRED: INTERNAL/EXTERNAL,
STAFF/MANAGEMENT/BOARD, VENDORS/CLIENTS,
GOVERNMENT/REGULATORS)
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 6. REPORTING
GOING FURTHERRESPONSECONTEXT

12. 12
ROOT CAUSE ANALYSIS
(IDENTIFY AND DOCUMENT INCIDENT TRIGGERS AND
SECURITY GAPS THAT ENABLED THE INCIDENT TO OCCUR)
CONTROLS AND PROCESSES READINESS
(EVALUATE THE EFFICIENCY OF CURRENT SECURITY CONTROLS
AND PROCESSES IN LIGHT OF THE INCIDENT)
INCIDENT TRENDS ANALYSIS
(ARE YOU LEARNING FROM PAST INCIDENTS? IS YOUR RISK
PROFILE CHANGING?)
MITIGATION PLAN
(MITIGATE IMPACT OF SIMILAR FUTURE INCIDENTS)
IMPROVEMENTS PLAN
(STOP OCCURRENCE OF SIMILAR FUTURE INCIDENTS)
PUBLIC
1
2
3
4
5
{elysiumsecurity}
cyber protection & response 7. LEARNINGS
GOING FURTHERRESPONSECONTEXT

13. 13
ANALYSIS
PUBLIC
CONTAINMENT/REMEDIATION
NETWORK
• BLOCK IP/PORTS/SERVICES;
• BLOCK EMAIL;
• CHANGE PWD
MALWARE
HOST
• UPDATE A/V AND F/W RULES;
• REMOVE MALWARE/SERVICES;
• CHANGE PWD.
• REMOVE SOFTWARE/PLUGIN;
• UPDATE SECURITY CONFIGURATION;
REMOVE SERVICES/LOCAL ADMIN.
{elysiumsecurity}
cyber protection & response GENERIC RESPONSE PLAYBOOK
GOING FURTHERRESPONSECONTEXT

14. 14
Forum of Incident Response and Security Teams (FIRST) FRAMEWORK
(https://www.first.org/education/FIRST_SIRT_Services_Framework_Version1.0.pdf)
National Institute of Standards and Technology (NIST) Special Procedure (SP) 800-61
(https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf)
International Organization for Standardization (ISO) ISO/IEC 27035-1:2016
(https://www.iso.org/standard/60803.html)
International Organization for Standardization (ISO) ISO/IEC 27035-2:2016
(https://www.iso.org/standard/62071.html?browse=tc)
CONTACT US!
(contact@elysiumsecurity.com)
PUBLIC
{elysiumsecurity}
cyber protection & response RESOURCES
GOING FURTHERRESPONSECONTEXT

15. {elysiumsecurity}
cyber protection & response
© 2015-2019 ELYSIUMSECURITY LTD
ALL RIGHTS RESERVED
HTTPS://WWW.ELYSIUMSECURITY.COM
ABOUT ELYSIUMSECURITY LTD.
ELYSIUMSECURITY PROVIDES PRACTICAL EXPERTISE TO IDENTIFY
VULNERABILITIES, ASSESS THEIR RISKS AND IMPACT, REMEDIATE THOSE
RISKS, PREPARE AND RESPOND TO INCIDENTS AS WELL AS RAISE
SECURITY AWARENESS THROUGH AN ORGANIZATION.
ELYSIUMSECURITY PROVIDES HIGH LEVEL EXPERTISE GATHERED
THROUGH YEARS OF BEST PRACTICES EXPERIENCE IN LARGE
INTERNATIONAL COMPANIES ALLOWING US TO PROVIDE ADVICE BEST
SUITED TO YOUR BUSINESS OPERATIONAL MODEL AND PRIORITIES.
ELYSIUMSECURITY PROVIDES A PORTFOLIO OF STRATEGIC AND TACTICAL
SERVICES TO HELP COMPANIES PROTECT AND RESPOND AGAINST CYBER
SECURITY THREATS. WE DIFFERENTIATE OURSELVES BY OFFERING
DISCREET, TAILORED AND SPECIALIZED ENGAGEMENTS.
ELYSIUMSECURITY OPERATES IN MAURITIUS AND IN EUROPE,
A BOUTIQUE STYLE APPROACH MEANS WE CAN EASILY ADAPT TO YOUR
BUSINESS OPERATIONAL MODEL AND REQUIREMENTS TO PROVIDE A
PERSONALIZED SERVICE THAT FITS YOUR WORKING ENVIRONMENT.